Like GandalfTheGray said, that ID (TsInternetUser) is used by Terminal Services. Are you using Terminal Services? Are these boxes that are 'crashing' behind a firewall? (which one). Are there any other 'werid' events in the other logs (system & application)?

Cheers: